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1. Background 


With the introduction of the Freedom of Information Act in January 2005 
it was anticipated that the number of requests received for information 
on the Office’s research projects would increase. Therefore, these 
procedures provide practical advice on the supply of such information to 
members of the public to meet the Office’s Freedom of Information Act 
obligations, and the steps we must take to ensure we continue to 
adhere to the Data Protection Act. 


2. Ownership of research data 


All research projects will be commissioned by the Corporate Affairs 
department through a competitive tender process. Contract 
documentation with the chosen research agency should ensure that the 
ICO holds full copyright ownership of the data. 


A PR1i must be raised as soon as the preferred proposal and cost 
estimate has been agreed and approved. 


3. Briefing research agencies 


To ensure that the appointed research agency is aware of the ICO’s 
obligations under the Freedom of Information Act, the subject should be 
included on the agenda of the first briefing meeting. 


At this point the following should be covered: 


e Freedom of Information Act 
o briefing on the ICO’s obligations; 
o the ICO’s role in enforcing the Act the impact of the Act on 
research data provided by the research agency; 
o Copyright protection (see section 2); 


o Data Protection Act and its interface with the Freedom of 
Information Act. (see section 4); and 
o Publishing of research on the ICO’s website (see section 5) 


4. Data Protection Act and its interface with the Freedom of 
Information Act 


The research data from each project should be evaluated to see if any 
personal information can be identified through the results. 


If personal information is evident, the nature of the personal 
information needs to be assessed. For instance if concealing the names 
of the respondents would make the information anonymous then this 
data (with the names concealed) can still be given out under the 
Freedom of Information Act. This would also be the case if the individual 
was able to identify themselves, even with their name concealed. As in 
this case the individual may be able to identify themselves through the 
data provided but another member of the public would not be able to. 


In most projects concerning members of the general public the 
information would be completely anonymous. 


However, to ensure the department is not in breach of the Data 
Protection Act in this situation the data files should be sent through to 
the Freedom of Information department for consideration. 


5. Research data on the ICO website 


A section of the ICO website has been allocated to Corporate Affairs 
research projects. It can be found on the home page under ‘About us’. 


Research projects are categorised into the following: 
e Data protection; 

Freedom of information; 

Corporate; 

Annual track; and 

Archive. 


In the relevant research section of the website the following should be 
placed: 

e notice of current research projects; 

e questionnaires; and 

e research findings reports including methodology. 


It is not common practice to place SPSS or excel data files on the 
website, though if a Freedom of Information Act request for the files is 
received, as long as it is not exempt (see section 6), they should be 
forwarded to the person requesting the information within 20 working 
days. 


6. Freedom of information requests 


If a written request for information is received and the research data is 
deemed not to be exempt, the data should be forwarded to the member 
of the public requesting the information within 20 working days, in the 
medium requested. 


A covering letter should also be sent out with the data. The letter should 
include: 


e an introduction to the project the data is derived from, including the 
objectives of the project and what the ICO has used the data for; 
how the research was conducted; 

sample size and any relevant notes; 

Crown copyright notice; and 

paragraph offering further assistant. 


A sample covering letter is included in Appendix 1. 


7. Procedure review 


It is proposed that these procedures will be reviewed at twelve month 
intervals. 


APPENDIX 1: Sample Letter 


Address 


Date 


Dear K K K OK K K 


Re: Who Cares About Data Protection?: Segmentation Research 2003 


Thank you for your request for the data files for the segmentation 
research 2003. 


The Information Commissioner's Office commissioned the segmentation 
study in July 2003 to identify how individuals may be grouped based on 
their privacy concerns and to identify any observable variables from the 
groups such as their media readership, viewing habits, socio economic 
status, age, internet use. 


The research identified five cluster groups. The identification of these 
cluster groups has allowed the Information Commissioner’s Office to 
tailor its communications strategy to more accurately meet the needs of 
these different segments. 


The sample for the study consisted of 746 in home interviews, 
conducted in homes across the UK between 14 July 2003 and 30 July 
2003. The sample structure was in line with the UK national profile. Due 
to the size of the sample it should be noted that the results from this 
study are not conclusive. 


I would be grateful if this information was re-used accurately and not in 
a misleading context. Also if you intend to re-use the information it 
must be acknowledged as ICO copyright with the title specified. 


I hope that this information is of use to you. If you would be happy to 
let me know more details of the project you are working on I may be 
able to supply you with further information specific to the project. 


Yours sincerely 


